Abandoned Popcorn Time RCE unpatched; updater disabled on 2 million systems

What happened

Eye Security researchers found a remote code execution flaw (CVE-2026-30612) in Time4Popcorn, an abandoned Popcorn Time fork still installed on millions of machines. The app's updater downloads and runs any code served by its domains with full privileges, and no vendor fix will come because the project is abandoned. The researchers registered the abandoned domains and remotely disabled the updater on roughly 2 million systems by March 2026.

Why it matters

Eye Security estimated 2.5-3 million Windows systems, 250,000-350,000 macOS systems, and fewer than 200,000 Android devices, including connections from corporate, government, and military networks. Anyone controlling one of the domains could have turned these devices into a botnet or surveilled specific machines. Even with the updater disabled, the app runs a 2014 Chrome with no sandbox, so the risks remain.

What to do

Uninstall Popcorn Time/Time4Popcorn from all machines: the researchers' fix only disabled the updater and no vendor patch exists. On Android, disabling requires user interaction and the updater cannot be disabled separately. Check corporate network traffic for connections to Popcorn Time update domains.

For the technical team

CVE

CVE-2026-30612

Affected

Time4Popcorn (fork do Popcorn Time) para Windows, macOS e Android · All versions of Time4Popcorn (distributed as Popcorn Time) for Windows, macOS, and Android; abandoned project, no fixed version.

Exploitation

No exploitation in the wild reported in the sources. Eye Security created a proof of concept that executes calc.exe via JavaScript, confirming the risk. The updater domains remain sinkholed by the Shadowserver Foundation.

Fix

No vendor patch. Eye Security pushed an update that disables the updater: on Windows it stops and disables the service via the Service Control Manager without deleting files; on macOS a shell script blocks the update process from starting. Roughly 2 million systems received the fix by March 2026, a 98% reduction in update requests. On Android, the updater is part of the app, requires user interaction, and cannot be independently disabled. Manual mitigation: disable the updater and completely uninstall the application.

Vector

Time4Popcorn update mechanism: runs in the background at system boot, periodically queries update domains over unencrypted HTTP, has no code signing, and downloads and runs any supplied executable with System/root privileges. Exploitable by registering an abandoned domain or via a man-in-the-middle attack.

More details

Eye Security's 'Operation IXIM' began in November 2025; the firm registered 15 abandoned domains, including popcorntimeupd.xyz. In March 2026 it stopped serving the update and transferred the domains to the Shadowserver Foundation, which also sinkholed abandoned domains the app loaded JavaScript from. The update was flagged as malware after a VirusTotal upload and had to be tweaked. The app is built on a 2014 Chrome with no sandbox. System estimates: 2.5-3 million Windows, 250,000-350,000 macOS, fewer than 200,000 Android.

Indicators (IoCs)

• popcorntimeupd.xyz

Timeline

1. 10/27/2026 06:50 AM

   SecurityWeek details the mechanism: the updater runs at system boot and periodically polls the update domain to execute any code served, with full privileges.

2. 10/26/2026 01:11 PM

   Incident opened.

Sources 5 sources

• Operation IXIM: Preventing a botnet of millions of Popcorn Time users Eye Security
• CVE-2026-30612: A vulnerability in Time4Popcorn (PopcornTime) Eye Security
• Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet The Hacker News
• Abandoned Popcorn Time app exposed millions of devices to RCE attacks BleepingComputer
• Abandoned Popcorn Time apps had to be disabled to prevent a zombie army The Verge

See all 6 sources

• Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover SecurityWeek

See all news